December 2003 - cypherpunks-legacy

Re: IRC & HTTP proxy servers (fwd)
by Deanne Morgan 17 Dec '03

17 Dec '03

This is a copy of my reply to Jonathan Cooper's request for legitimate uses of anonymous services... DHM. ---------- Forwarded message ---------- Date: Wed, 16 Nov 1994 18:47:58 -0400 (EDT) On Wed, 16 Nov 1994, Jonathan Cooper wrote: > Is there any interest in IRC and HTTP anonymizing proxy servers? Yes. > My question (which I have about most anonymized services) is what the > legitimate uses would be. I'm currently in a code-till-I-drop mindset, > but I really don't want people using these services just to sling > porn-o-the-day or to irritate people on irc. An example of use of anonymous servers: There is a newsgroup called alt.sexual.abuse.recovery [among others], a healing forum for survivors of sexual abuse/assault [often childhood sexual abuse], their significant others, and other support people. For obvious reasons, for many there is a need for anonymity [many of those who post would be killed VERY quickly if their true location/identity were discovered]. There is also an irc channel, #**** <name deleted> which is used by "asarians" for "live" discussions of many issues, ranging from very serious survivor issues to having electronic snowball fights. Again, for many, anonymity is VERY important. So yes, there ARE some very legitimate uses for anonymous servers, whether irc or email or netnews posting... If you want any further info, please ask. DHM.

1 0

CEB6 1 of 2
by Gary Jeffers 17 Dec '03

17 Dec '03

CYPHER-REBELS ELECTRONIC BOOK (CEB) NOVEMBER 17, 1994 ISSUE 6 Publisher Gary Lee Jeffers ccgary(a)mizzou1.missouri.edu THE ORIGINAL, FIRST, & OTHER "OFFICIAL" "ORGAN" OF THE CYPHERPUNKS LIST (That is still in existence.) NOTE: Items bounded by /* & */ are new text - Differ from last issue. IS YOUR SOFTWARE TYRANNICIDAL? If so, Cypherpunks & the CEB want to hear about it! A compendium of the best software & info for today's electronic privacy Freedom Fighters. This text may be distributed in part or in full anywhere you want. It may be given away freely or copies may be sold. CEB wants to be free & valuable. If, as Chairman Mao says: "Political power grows out of the barrel of a gun.", then what is democracy? /* Currently, we have Fortress Cryptography & State Sufferance remailers, mailing lists & newsgroups. We must have Fortress: remailers, mailing lists & newsgroups! */ This file may or may not be found on ftp.csua.berkeley.edu pub/cypherpunks/ ? with filename CEB5. TABLE OF CONTENTS Chapter 1. PGP Section 1. PGP general Section 2. Michael Johnson's PGP FAQ contribution Section 3. Stealth PGP. /* Section 4. PGP2.6.2 from Sameer. */ Chapter 2. Steganography. "A picture is worth a thousand words." Chapter 3. Shells for PGP Section 1. Christopher W. Geib's WinPGP26.ZIP Section 2. Ross Barclay's WinFront 3.0 /* ftp information added. */ /* Section 3. Ed Carp's PGPWIND ver 0.1.g */ Chapter 4. Generally cool things. Section 1. Loompanics sources. Section 2. Viruses sources. Chapter 5A. Getting the Cypherpunks' archived & indexed list. /* ITS GONE! ITS GONE! */ /* Chapter 5B. Secure Drive download location from Raph. */ Chapter 6. Remailers & chained remailers. /* text correction for anon.penet.fi */ Chapter 7. Current problems in Crypt. Chapter 8. Text sources. Section 1. Books Part 1. Simson Garfinkel's PGP book. Part 2. Bruce Schneier's cryptography book. Part 3. William Stallings PGP book. Section 2. Rants Section 3. CYPHERNOMICON - Tim May's "official" Cypherpunks' FAQ. Chapter 9. Cypherpunks' mailing list. getting on etc.. Chapter 10. IRC chat strong encryption? Section 1. prig(cryptical)'s offering. /* Section 2. Ed Carp's offer. */ CCCCCCCCCC YYYY YYYY PPPPPP HH HH EEEEEEE RRRRRRRRR CCCCCCCCCC YY YY PP PP HH HH EEEEEEE RRRRRRRRR CCC YY YY PP PP HH HH EE RR RR CCC YY YY PPPPPP HHHHHHHH EE RR RR CCC YYY PP HHHHHHHH EEEEEEE RR RR CCC YYY PP HH HH EEEEEEE RRRRRRRR CCC YYY PP HH HH EE RRRRRRR CCC YYY PP HH HH EE RRRRRR CCCCCCCCCC YYY PP HH HH EE RR RR CCCCCCCCCCC YYY PP HH HH EEEEEEE RR RR PP HH HH EEEEEEE RR RR RRRRRRRRRRR RR RR RRRRRRRRRRRRRR RRRRRRRRRRR EEEEEEEEEEE BBBBBBBBBBB SSSSSSS RRRRRRRR EEEEEEEEE BBB BBBBBBB SSSSSSSSS RR RRRR EEEEEEEEEE BB BBBBBB SSSSSSSSS RRR RRRR EEEEEEEE BBB BBBBB SSSSSSSSS RRR RRRRR EEEEEE BBBBBBBBB SSSSSSSSS RRRRRRRRRRRRRR EEEEEEE BBBBBB SSSSSSSSSS RRRRRRRRRRRRRR EEEEEEEEEE BBBBB SSSSSSS RRRRRRR RRRR EEEEEEEEEE BBBBBB SSSSSSSSSSSSS RRR RRRRR EEEEEEEEEEEE BBBBBBBB SSSSSSSSSSSS RRRRR RR EEEEEEEE BBBBBBBBBB SSSSSSSSSS RR RRRRR EEEEEE BBB BBBBBBB SSSSSSSSSS RR RRRRR EEEEEE BB BBBBBB SSSSSSSSSS RRR RRRRRR EEEEEEEEEEE BB BBBBBBB SSSSSSSSSSS RRRR RRRRRRR EEEEEEEEEEEEE BBBBBBBBBB SSSSSSSSSSSS PPPPPPPPPPP GGGGGGGGG PPPPPPPPPPP PPPPPPPPPPP GGGGGGGGG PPPPPPPPPPP PPP PP GGG PPP PP PPPPPPPPPPPP GGG GGGGGGG PPPPPPPPPPP PPPPPPPPPP GGG GGGGGGG PPPPPPPP PPP GGG GG PPP PPP GGGGGGGGGGGGG PPP PPP GGGGGGGGGGGG PPP Chapter 1. PGP general. PGP is Pretty Good Privacy from Phil Zimmermann. It is currently the best available encryption available to civilians at large. Zimmermann is the programmer on the original PGP versions but now, apparently, just guides other programmers in making improved versions. PGP uses two encryption algorithms: RSA for its Public Key powers & IDEA for its bulk encryption. The advantages of PGP over other crypt/decrypt systems are: 1. RSA algorithm. Allows users to communicate without needing a secure channel to exchange keys. - PUBLIC KEY ENCRYPTION. 2. The program system has been very well done & has huge development support. 3. It has huge popularity. 4. Security is guaranteed with distribution of source code & public investigation. 5. Its free. 6. Both RSA & IDEA are "STRONG" algorithms. Section 2: Michael Johnson's PGP FAQ contribution Michael Paul Johnson <mpj(a)netcom.com> has an excellent faq on Subject: Where to Get the Latest PGP (Pretty Good Privacy) FAQ /* (Last modified: 31 October 1994 by Mike Johnson) */ You can get this faq by anonymous ftp to: ftp.csn.net /mpj/getpgp.asc It is also posted monthly on alt.security.pgp The latest versions of PGP are VIACRYPT PGP 2.7 , MIT PGP 2.6.2 & PGP 2.6ui & the new PGP 2.6.i . Which is best? I would say MIT PGP 2.6.2 although PGP 2.6.i is a close contender. MIT's has source code, Phil Zimmerman's blessing & is US legal. For a further discussion of variations, consult Michael Johnson's FAQ. Section 3: Michael Johnson's PGP bomb contribution. From: Michael Johnson <mpj(a)csn.org> Subject: PGP Time Bomb FAQ PGP TIME BOMB FAQ Michael Johnson writes: "There has been some confusion about the annoying "Time Bomb" in MIT PGP2.6, as well as some other PGP version compatibility issues. This is an attempt to clear up some of that confusion." You can get this faq by anonymous ftp to: ftp.csn.net /mpj/pgpbomb.asc /* Section 4. PGP2.6.2 from Sameer. From: sameer <sameer(a)c2.org> Subject: PGP 2.6.2 on ftp.csua.berkeley.edu Date: Thu, 27 Oct 1994 03:19:19 -0700 (PDT) PGP 2.6.2 is now available on ftp.csua.berkeley.edu in /pub/cypherpunks/pgp/pgp262 Not for export outside of the United States in violation of ITAR restrictions. -- sameer Voice: 510-841-2014 Network Administrator Pager: 510-321-1014 Community ConneXion: The NEXUS-Berkeley Dialin: 510-549-1383 http://www.c2.org (or login as "guest") sameer(a)c2.org */ Section 3. Stealth PGP 37 Stealth PGP refers to a PGP file that does not have the RSA prefix tag on the beginning of a PGP encrypted file or to PGP utility software that disguises this tag. Possibly, a later version of PGP with have this as an option. The advantages of "Stealthy" PGP are that its files cannot be found by Internet search programs that hunt for the PGP/RSA tag & that a "Stealthy" file may be more securely hidden by a good steganography program. From: Mark Grant <mark(a)unicorn.com> Subject: Stealth PGP Responding to my question "Has Stealth PGP been done yet?" Mark Grant says: Kind of, there's a 'stealth' filter available that strips and attaches headers to PGP messages after encryption. It's available from various places, and the documentation is available on my 'other people's PGP addons' WWW page : http://www.c2.org/~mark/pgp/other.html There's also information about Privtool, my PGP-aware mail program for Sun workstations at : http://www.c2.org/~mark/privtool/privtool.html Mark EMAIL: mark(a)unicorn.com URL : http://www.c2.org/~mark/ Chapter 2. Steganography "A picture is worth a thousand words." ============================================= %% = !I = %% %%% = !!! BB = %%%* *%%%% = **!!** & = *** @** = u \ x! ) < = * *** + m ) c $ = ** = # k } º = º = $%- & u = = ------- = @!p +e$ ~ # = º = h 6& ; | = º = =,# {{ = º = = º º = = º º = = º º ============================================= º º STILL LIFE WITH CRYPT +++++++++++++++++++++++++++++++++++++++++++++ Steganography is the craft of hiding messages in pictures. The text is, of course, encrypted text rather than plain text. The current best steganography program has been done by Arsen Arachelian Below, follows his text contribution: From: rarachel(a)prism.poly.edu (Arsen Ray Arachelian) WNSTORM is available from: ftp.wimsey.bc.ca:/pub/crypto/software/dist/US_or_Canada_only_XXXXXXX/Steg Usual routine to get it. i.e. cd /pub/crypto/software, get the README file, and if you agree to the terms then follow the instructions. Short description off the top of my head (I wrote the beastie) Another info scrap should be in the same directory as WNSTORM. WNSTORM is a data encryption/steganography utility which is pretty secure for most uses. Unlike some stego systems WNSTORM is expandible, all you have to do is write your own LSB injector/extractor for whatever data format you wish to hide information into. WNSTORM doesn't require the recipient of the host picture, sound, movie, etc. to have the original un-stormed picture. Unlike primitive stego programs, WNSTORM doesn't compare an stormed picture with an unstormed picture. WNSTORM will cover its tracks statistically. If it changes a 0 bit in the LSB data stream to a zero, or a 1 bit to a 1, it does nothing. If it changes a 1 bit to a zero, it will balance itself by changing an unused adjacent 0 bit to a 1. Ditto for a 0->1 transform. WNSTORM will NOT change every bit of the LSB in order to prevent detection. It will use a passkey along with a probabilistic algorithm to decide which bits it will change. The algorithm for picking bits depends on the previous succesfully encoded/decoded cyphertext AND the passkey. Internally WNSTORM works by picking "windows" or "packets" of bytes out of either a random number stream or an LSB stream extracted from a picture, sound, movie, etc. It then injects eight bits of cyphertext into this window. Each window is of variable size. The bit locations where the bits are inserted are randomly exchanged for each pass. The bit values are also randomly exchanged for each pass. WNSTORM includes an injector/extractor for PCX images, however I will write more injecotr/extractor programs for it in the future, and OTHERS can do so as well. Chapter 3. Shells for PGP. Section 1. Christopher W. Geib's WinPGP26.ZIP From: "David K. Merriman" <merriman(a)metronet.com> Subject: Christopher W. Geib's Windows PGP shell I've just finished making an ftp deposit to soda in the cypherpunks/ incoming directory of WinPGP26.ZIP; it's the latest version of the Windows PGP shell Shareware, and understands 2.6/2.6ui/2.7. Dave Merriman Section 2. Ross Barclay's WinFront 3.0 From: Ross Barclay <RBARCLAY(a)TrentU.ca> Subject: PGP WinFront 3.0 Now Available! (New Windows front end for PGP) To: cypherpunks(a)toad.com, ~rbarclay(a)TrentU.ca -----BEGIN PGP SIGNED MESSAGE----- /* signature wrecked due to included text from another contributor. Gary Jeffers */ Announcing PGP WinFront 3.0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~ A freeware Windows front end for PGP 2.3a and 2.6 Copyright 1994 Ross Barclay (rbarclay(a)trentu.ca) WHAT IT IS: - PGP WinFront is the most fully featured free (or otherwise) Windows front end available. It will make using PGP easy for beginners, and it will drastically increase the speed at which experts use it too. PGP WinFront is now into is third revision and I have tried to implement as many of the suggestions that I received as possible. PGP WinFront was designed by its users, but was coded by me. Features: - Supports secret key ring placement on floppy drive - Support en/decryption to/from clipboard - Move / Copy / Delete files - Online hypertext help - Online hypertext PGP help - Keyring reader to pick names, view key characteristics - Keyring reader supports less-often used "huge" keyrings - Signature Checker - Very configurable - over 25 user-definable settings - more . . . This program does too much to list here. And it's free! This version is a complete rewrite of the popular PGP WinFront 2.0. The feature-set has largely been set by users who sent in suggestions. Please read the file README.TXT and peruse the help files. Please send me your comments. HOW TO GET IT: At the moment, there are 2 ways to get this program: 1) Via FTP - The PGP WinFront 3.0 filename is called PWF30.ZIP. - It has been uploaded to the incoming directories of the following FTP sites: ftp.cica.indiana.edu ftp.eff.org ftp.wimsey.bc.ca /* from Gary Jeffers. There has been a problem getting pwf30 from these sites. However, it CAN ACTUALLY be ftp'ed with the following info.: ftp.wimsey.bc.ca: /pub/crypto/software/dist/US_or_Canada_only_XXXXXXXX/PGP/Misc/pwf30.zip */ -- Mark Henderson -- markh(a)wimsey.bc.ca, henderso(a)netcom.com (personal accounts) RIPEM 1.1 MD5OfPublicKey: F1F5F0C3984CBEAF3889ADAFA2437433 ViaCrypt PGP Key Fingerprint: 21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 cryptography archive maintainer -- anon ftp to ftp.wimsey.bc.ca:/pub/crypto */ black.ox.ac.uk soda.berkeley.edu ftp.informatik.uni-hamburg.de ftp.ee.und.ac.za ftp.demon.co.uk - Hopefully, they will be slotted into the PGP directories soon. On CICA, it will be placed into \pub\pc\win3\utils. That is where PWF20.ZIP was placed. - Once you get the program, please upload it to other FTP sites! 2) From Colorado Catacombs BBS - dial (303)772-1062. The file is called PWF30.ZIP - once you get the program, please upload it to other BBSs. *** The mail access system I had was discontinued. This is because the file was too big to fit into my account. However, you can still register PWF and request certain PGP and PWF related items using my mail access system. Details of these are on the "About" screen of PWF 30. - --Ross Barclay - ------------------------------------------------------------------------- Ross Barclay (rbarclay(a)trentu.ca) Assistant Editor | To receive my PGP | public key, send PC NEWS Review: Windows Edition | me e-mail with the Bellevue, WA (206) 399-8700 | subject: GET KEY - ------------------------------------------------------------------------- To receive PC NEWS Review, send me e-mail with the subject: GET PNR. - ------------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLmZ7fdgpRteEZ9JhAQFeXgIAxIpvJQeMsx7YecNgtusBDMqL662XFeX2 qL0qF8HcN4ReZ9MYjtn9t8N1zWGxkPOXQEI3KfM7uk8JTzxjZ5LG2g== =gSYT -----END PGP SIGNATURE----- /* Section 3. Ed Carp's PGPWIND version 0.1.g */ From: ecarp(a)netcom.com (Ed Carp) Subject: PGP For Windows 0.1.g release Date: Thu, 17 Nov 1994 01:44:41 -0800 (PST) -----BEGIN PGP SIGNED MESSAGE----- The latest release of PGP For Windows is in ftp.netcom.com:/pub/ecarp/pgpwind.zip Several bug fixes, and an occasional feature or two :) Now you can set the font for the program if you don't like the default. ;) Thanks to Dave Merriman and D. Morgan for beta testing. The next release will hopefully have online help for the program itself, even though it's pretty straightforward. Comments, bug reports to me. Thanks! - -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com Finger ecarp(a)netcom.com for PGP public key an88744(a)anon.penet.fi If you want magic, let go of your armor. Magic is so much stronger than steel! -- Richard Bach, "The Bridge Across Forever" -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLssmBSS9AwzY9LDxAQHa/QP/YjxnZJWlK4VWrolr1fe75m/0YjGhHyEN dLsLOUbiR0riz6oO0WaExQUaSh4mefpgniHc9tSkCreL6dBG+hdA6qwNlUVMCANV dxAXw0E9SQUxoLDPY1pbbEcyoDmu7Im2qg52WTMvKELbKWOyiIdtbc+BupCjfhw3 g6YPzIAXaB4= =vYWD -----END PGP SIGNATURE----- Chapter 4. Generally cool things. Section 1. Loompanics sources. Something cool from Vincent: Most of the Loompanics Unlimited catalog is online as: gopher://gopher.well.sf.ca.us/00/Business/catalog.asc And you can send mail to them at: loompanx(a)pt.olympus.net You can also get their catalog at: Loompanics Unlimited PO box 1197 33 Port Townsend, Wa. 98368 P id Send $5.00 for their general catalog - free with any order. Section 2. Viruses sources. AMERICAN EAGLE PUBLICATIONS Cypherpunks, I have found a source of info. that I just must share! American Eagle Publications, Inc. P. O. Box 41401 Tucson, AZ 85717 I'm sure they will send you a catalog just for the asking. So, what are they about? They are about VIRUSES! They don't just carry a couple of virus things - they are the VIRUSES-ARE-US of the virus world! They have a journal: Computer Virus Developments Quarterly. They have books on viruses, virus protection, cryptanalysis, the science fiction book "Heiland", a CD-ROM for $99.95 of several thousand live viruses, disks of viruses with source code, executable & utilities, programs & cards for boot protection, & even a virus IDEA computer system protector. Copy follows for two items of particular interest to Cypherpunks: POTASSIUM HYDROXIDE, KOH By the "King of Hearts" A sophisticated piece of software which uses ideas first developed by computer virus writers to secure your computer system against those who would like to get their hands on the information in it. You give KOH a pass phrase, & it uses state of the art IDEA data encryption algorithm to encrypt all of the information on your hard disk & your floppies. It is, for all intents & purposes, unbreakable, & works well with DOS & Windows. Many encryption programs offered commercially are easily cracked, but this one is not. Some people call this program a virus, come say it is not. In ways, it acts like a virus to do some of your security housekeeping for you. Yet at worst it is a friendly virus that lets you choose when & how it will replicate. program & manual on disk, $10 program, full source, & manual on disk, $20 (Overseas customers add $12: KOH cannot be exported from the US, but since it was not developed in the US, we will forward your order to the overseas distributor. Please allow 6 weeks for delivery) HEILAND By Franklin Sanders 276 pages, Paperback, 1986 Here's an entertaining book about America in the year 2020. If you wonder if it's proper to use viruses in wartime or if such a virus could be termed "good", this book will give you some food for thought. Sanders makes use of computer "worms" when the oppressed people of the US attack the federal government in an all-out war against tyranny. Sanders uses his worms right too - not as some all-powerful monster. Rather, they are deployed as part of a larger military strategy. For a book written in 1986, that's not bad! And if you're fed up with the government, this book is sure to give you a vision for the future. Sanders has been part of the mounting tax protest in this country. He's fought the IRS in court for years & won some important battles. Unfortunately the government seems to be con- firming some of his worst suspensions about them. Now you can get a good dose of his philosophy & his ideas about remedying our problems. And if you work for the government, don't be offended - this book is doubly recommended for you! Book, $8.00 for shipping add $2 per book. 5% sales tax for AZ. residents. It is my belief that in the next few years more uses for viruses than just being a vandal will be found. Also, they may find a place in protecting our electronic freedom. - for instance virus remailers. Also see my previous post - The FREEDOM DEAMON. Also, they have a place in my CHATTERBOX concept(a remailer for chat mode or commands). "Viruses aren't just for Sociopaths anymore!" Also, I suspect the state may start cracking down on virus tech- nology. Incidentally, did you all know that crypt has a place in modern viruses? Encryption is used to hide "nasty" code & virus signatures until they get into the system & decrypt. Yours Truly, Gary Jeffers PUSH EM BACK! PUSH EM BACK! WWWAAAYYY BBBAAACCCKK! BBBEEEAAATTTTT STATE ! Chapter 5A. Getting the Cypherpunks' archived & indexed list. Vincent also tells us about the complete Cypherpunk's text on line & indexed with fast access times: Eric Johnson has put one together as: /*ERIC JOHNSON HAS CONTACTED ME & SAYS THAT IT NO LONGER EXISTS! *That's too bad. Well, I guess I'll finally stop embarassing Eric * by referring to it.*/ /* LOTS OF BADLY EDITED & NOW OBSOLETE TEXT DELETED. */ /* Chapter 5B. Secure Drive download location from Raph. ftp to ftp.netcom.com mpj/I_will_not_export/crypto??????

1 0

: Anon III - RFM
by Tomaz Borstnar 17 Dec '03

17 Dec '03

Key for user ID: Tomaz Borstnar <tomaz.borstnar(a)arnes.si> 1024-bit key, Key ID BC52F895, created 1993/12/06 -----BEGIN PGP SIGNED MESSAGE----- Hello! This is one of proposals for anonymous irc on IRC network called Undernet (servers: undernet.org, us.undernet.org, eu.undernet.org) Author is Denis Holmes (dholmes(a)rahul.net) - ------- Forwarded Message date: Wed, 16 Nov 1994 22:22:58 -0800 (Note, non-list mail) Hmm, I wasn't gonna just send ya the proposal again, but on second thought, I guess I will. I've put the test servers back up so you can see it if you want. My recommendation is that if there is a user desire for anonymity, having them post to the newsgroup or wastelanders would probably have the strongest impact. A statement of why they feel it is necessary and/or beneficial would be heard best I expect. I can give a couple reasons offhand why I didn't pursue this further: - - - Very few people expressed support for the idea. - - - It looked like I would be expected to upgrade it to the latest server level, yet I have not been provided with details of code changes despite my requests. And my suggestions to consult with others prior to any non-trivial code change (basically) have not been well-received. - - - Arguing about it became a waste of too much time. Well, that's not entirely true; one of the goals I was after has started to happen. Maybe that's a more legitimate reason than any of the others for laying off a bit. Subject: Anon III - RFM Revised summary of ideas for an anonymous IRC service. This proposal is dated 2 October 1994 (version III). Proposal: (n.) something put forth for consideration. RFM: Request For Mail. If you realize a way the service described below can be abused by users, please mail dholmes(a)rahul.net with the information, and be as specific as possible. Thoughts on how the service might be improved are also welcome. If needed, additional mail discussion will be used to try to determine the least intrusive solutions to problems received. A new revision or status will be posted to wastelanders when appropriate. Please do not send me your wonderful ideas on registering users, restricting mode changes, or other "problemless solutions" (unless requested or it concerns one of the particular points below). While these ideas may have merit, if they do not address specific abuses peculiar to this service, then they will most likely not fall into the category of "least intrusive solutions" being sought as described above. An implementation of Anon III is currently available for testing at jive.rahul.net port 5853. A standard Undernet server is connected to it and runs on port 5854. Please send me your observations, bug reports, and results (good and bad) from using various clients. The following points describe features of the proposed service, or restrictions to be placed on its users. "Registration" as used below refers to the normal process of a client signing onto a server and having its presence propagated across the net. * Use a special server to provide a high level of service, so that users are able to operate in the environment to which they are accustomed. After connecting to this server and registering in the normal fashion, a client becomes anonymous by sending a specific command to the server, upon which the server performs any checking, signs the user off the net, and reregisters the user. * Insure that each anonymous client is registered with a unique user@host combination so that individual users can still be banned from channels, ignored, etc. (User appears as anon376@<servername>, and must disconnect from the server (signoff) in order to change this. Also provides for banning of all anonymous users from a channel.) * Furthermore, a user becoming anonymous more than once within a certain period (let's say a day, for now, but this may vary at the admin's discretion) will receive the same anonymous identification on subsequent invokations after the first. This provides further protection against ban and ignore evasion. * Users of the service will be logged. (It should be noted, however, that, in general, this information will not be released except as required by law. The purpose here is to assist the administrator in assuring appropriate use of the service.) * Disallow anonymous oper (IRC/server operator) status. (This means that opers becoming anonymous will also be de-opered.) This prevents unidentifiable discontent operators from disrupting the net. * Block CTCP CLIENTINFO and USERINFO requests. This protects against users deliberately attempting to cause other users to flood or overload their connections without being identified. * Block CTCP FINGER and USERINFO replies, to protect client anonymity. * Lower the flood detection threshhold for anonymous users, so they're killed more quickly upon trying to flood. * Detect reconnecting users who were anonymous (users connecting who disconnected less than [60] seconds ago and were anonymous) and prevent them from joining channels or sending messages/notices for [30] seconds. This will stop queued messages within the client (from a would-be flooder) while still protecting the user's anonymity. * Ability to allow or deny anonymity based on address. This allows the administrator to deny known abusers the privelege of using the service. * Disallow multi-mode changes (i.e. allow only one channel mode change per MODE command). Also allow mode change or kick only once every "few" seconds. This provides channel operators time to react if an anonymous user attempts to take over a channel. Ensor. +----------------+-------------------+------------------------------------+ | Dennis Holmes | dholmes(a)rahul.net | "We demand rigidly defined | | San Jose, CA +-------------------+ areas of doubt and uncertainty!" | +------=>{ Meanwhile, as Ford said: "Where are my potato chips?" }<=------+ - ------- End of Forwarded Message -----BEGIN PGP SIGNATURE----- Version: 2.6.i iQCVAgUBLsv+dlheSYu8UviVAQEzdAP7BHVj0RjYWrlTuTRdMfpCLTCuiKMW3PQf cj9t2x811Z1E1LLXl+45i7KTCjcygmdh8OdyTU0B/xCvivzwSTq+OeXhlUZ6+AdN TjPz1hUt+s/TDT1n2RRgKFHhKCTCw/UuI3yPVnRy+/+2Bkpai6byVBSXRqJiGa6X HiM4L4BdrBY= =WIGV -----END PGP SIGNATURE-----

1 0

re: changes to remailer@jpunix.com
by Karl Lui Barrus 17 Dec '03

17 Dec '03

I read about some changes that John Perry made to his remailer, since it is being abused. (Sorry to hear it!) I thought he said he is doing source blocking (I deleted the message and can't check.) Is this true? Were there no hops between the abuser and the remailer? How can you prevent the abuser from just chaining through different paths to reach your remailer and continuing to use it? Or am I remembering incorrectly ;) Random Factor suggested (among other things) > * require encryption for incoming messages. Requiring encryption is OK, as long as you don't require the remailing header and message body to be encrypted together. If you do, like the extropia remailer does, then you can't form reply blocks that include such a remailer (since the reply block is created by a sender who obviously doesn't have the message body that his recipient will use the reply block to respond to).

3 3

Remailer Blocking and Negative Reputations
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Just a quick note: Blocking the sources of messages deemed offensive is a "negative reputation" approach, easily bypassed by creating a new source name. (And this can be done easily by using another remailer first.) I'm not arguing for a positive rep system here, as I'm not sure how it would work. I just wanted to the note that the solution of blocking offending sources has limited use. (Unless the blocking propagates back to the first-non-remailer use...require remailers to cooperate on maintaining a black list.) --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tcmay

3 2

CEB6 part 2 of 2
by Gary Jeffers 17 Dec '03

17 Dec '03

Hunt around & read his read file. Files in this directory are not for export from the USA and Canada. secdev13.arj -- Secure Device file hosted device driver by Artur Helwig of the Netherlands. sfs110.zip -- Secure File system by Peter Gutman of New Zealand secdr13e.zip -- Secure Drive by Mike Ingle and Edgar Swank of the USA */ Chapter 6. Remailers & chained remailers. From: wcs(a)anchor.ho.att.com (bill.stewart(a)pleasantonca.ncr.com +1-510-484-6204) Message-Id: <9408300753.AA22369(a)anchor.ho.att.com> To: CCGARY(a)MIZZOU1.missouri.edu Subject: Re: Using remailers, chained remailers? There's somebody who posts a remailer summary to the list about monthly. /* Text correction follows from Zarr -- Admin(a)anon.penet.fi (Admin of The Anonymous Contact Service) * There are three or four sets of remailers out there: * - anon.penet.fi, which gives you an account anNUMBER(a)anon.penet.fi * which people can reply to. Please, send a message to * ping(a)anon.penet.fi to receive an anon ID. You probably also want * to send a message to help(a)anon.penet.fi to receive the help file. * Its big use is for anonymous Usenet posting with working replies. end of text correction. */ some also support Usenet posting. Soda is pretty typical. - The cypherpunks remailers, which are mostly one-way no-reply mailers; - Various enhanced cypherpunks remailers, which have features like encrypted reply addresses you can attach at the end. You can get information on using the soda remailer by sending email to remailer(a)csua.berkeley.edu, with "help" somewhere in the posting; I'm not sure if it wants it in the Subject: or in the body. That's the remailer that posts from "Tommy the Tourist" with random NSA-bait at the bottom of postings. Here's a recent posting on getting status of remailers. Note that some really only remail once per day, so they may be working fine even if it says they're not. ---- Date: Mon, 15 Aug 1994 13:39:33 -0700 From: Raph Levien <raph(a)kiwi.CS.Berkeley.EDU> To: cypherpunks(a)toad.com Subject: "finger remailer-list(a)kiwi.cs.berkeley.edu" now operational Hi all, I have written and installed a remailer pinging script which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at http://http.cs.berkeley.edu/~raph/remailer-list.html Please do not take the uptime figures too seriously, at least for another week or so. The script has only been running reliably for a few days. Please let me know about any other remailers which I missed. I've only included remailers which can mail to arbitrary addresses, so I already know chop and twwells are missing. If you've got a Web page, please feel free to include a link to this page. If you think your Web page is relevant to the subject of remailers, let me know and I'll link it in. Comments and suggestions welcome! Raph Levien ------- # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465 Chapter 7. Current problems in Crypt. 1. We need an Internet Chat PGP system for conversations in real time. /* HEY! ITS LOOKS LIKE WE'VE GOT IT! SEE CHAPTER 10. */ 2. Has Arsen Arachelian really solved the problem of discovery of crypt in steganograpy by statistical examination of the least significant bits in his WNSTROM? I have seen no debate on this. 3. If the Feds capture the internet & put their anti-privacy hardware & protocols in place & outlaw remailers, does anyone have any idea how to build secure & effective remailers? A "Fortress remailer"? 4. If the above possibility happens & Cyperpunks' list is outlawed, does anyone have ideas how to make a "Fortress list"? /* Currently, we have Fortress Cryptography & State Sufferance remailers, mailing lists & newsgroups. We must have Fortress: remailers, mailing lists & newsgroups! */ Chapter 8. Text sources. Section 1. Books. Part 1. Simson Garfinkel's PGP book. From: Stanton McCandlish <mech(a)eff.org> Subject: O'Reilly PGP book Date: Wed, 7 Sep 1994 13:38:58 -0400 (EDT) coming soon, PGP hits the mainstream: PGP: Pretty Good Privacy by Simson Garfinkel 1st Edition November 1994 (est.) 250 pages (est),ISBN: 1-56592-098-8, $17.95 (est) PGP is a freely available encryption program that protects the privacy of files and electronic mail. It uses powerful public key cryptography and works on virtually every platform. PGP: Pretty Good Privacy by Simson Garfinkel is both a readable technical users guide and a fascinating behind-the-scenes look at cryptography and privacy. Part I of the book describes how to use PGP: protecting files and email, creating and using keys, signing messages, certifying and distributing keys, and using key servers. Part II provides background on cryptography, battles against public key patents and U.S. government export restrictions, and other aspects of the ongoing public debates about privacy and free speech. -- <A HREF="http://www.eff.org/~mech/mech.html"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Fndtn. </A><P> Online Activist Part 2. Bruce Schneier's cryptography book. The best book in cryptography is: APPLIED CRYPTOGRAPHY Protocols, Algorithms, and Source Code in C by Bruce Schneier Loompanics advertising copy follows: In Applied Cryptography, data security expert Bruce Schneier details how programmers can use cryptography - the technique of enciphering messages - to maintain the privacy of computer data. Covering the latest developments in practical cryptographic techniques, the book shows programmers who design computer software and systems we use every day. Along with more than 100 pages of actual C source code of working cryptographic algorithms, this pratical handbook: * Explains data encryption protocols and techniques currently in use and likely to be used in the future. * Offers numerous present day applications - from secure correspondence to anonymous messaging. * Includes numerous source code fragments and shows how to incorporate them into larger programs. * Discusses related issues like patents, export laws, and legal rulings. And much more! 1994, 7 1/2 x 9, 636 pp, Illustrated, indexed, soft cover. APPLIED CRYPTOGRAPHY: $44.95 (order number 10062) $4.00 for shipping and handling. UPS ground. Additional $7.50 if you want UPS w day air(blue)- that would be $11.50. Loompanics Unlimited PO Box 1197 Port Townsend, WA 98368 /* Part 3. William Stallings PGP book. From: William Stallings <ws(a)shore.net> William Stallings says that his new book will be out in a few weeks. d The book's foreword is by Phil Zimmerman who highly praises the book & e states that he prefers it to his own documentation when he needs to look something up! The book's table of contents, then the foreword follows: | Bill Stallings | PGP key available at | also from Stable | Comp-Comm Consulting | gopher.shore.net | Large Email Database | P. O. Box 2405 | in members/ws | contact | Brewster, MA 02631 | | key(a)Four11.com Protect Your Privacy: The PGP User's Guide William Stallings (Prentice-Hall, ISBN 0-13-185596-4) Table of Contents Foreword by Phil Zimmermann Acknowledgments Reader's Guide to the PGP User's Guide Chapter 1 Protect Your Privacy! 1.1 What is PGP? 1.2 PGP Versions Part I HOW PGP WORKS Chapter 2 Basic Principles of PGP 2.1 Conventional Encryption 2.2 Public Key Encryption 2.3 Secure Hash Functions Chapter 3 Sending and Receiving PGP Messages 3.1 PGP: The Big Picture 3.2 PGP is Not E-Mail 3.3 Public Keys and Private Keys 3.4 Digital Signatures 3.5 Compression 3.6 Message Encryption 3.7 E-Mail Compatibility 3.8 The Order of Operations in PGP Chapter 4 PGP Features 4.1 Multiple Recipients 4.2 Encrypting Local Files 4.3 The Display-Only Option 4.4 Wiping 4.5 Protecting Text Files 4.6 Signature Options Chapter 5 Key Generation and Secret Key Management 5.1 Creating Public/Secret Key Pairs 5.2 Secret Key Management Chapter 6 Public Key Management 6.1 Exchanging Public Keys 6.2 Certifying Public Keys 6.3 Owner Trust and Key Legitimacy Part II USING PGP Chapter 7 DOS PGP: Getting Started 7.1 Getting Started 7.2 Key Generation 7.3 Signing Your Key 7.4 Extracting Your Key 7.5 Preparing a Message for Transmission 7.6 Processing a Received Message 7.7 Adding Keys to Your Public Key Ring 7.8 Certifying PGP Chapter 8 DOS PGP Reference 8.1 Message/File Processing 8.2 Key Management 8.3 Miscellaneous Commands and Options 8.4 The config.txt File 8.5 Using a DOS Shell Chapter 9 Macintosh PGP: Getting Started 9.1 Getting Started 9.2 Key Generation 9.3 Signing Your Key 9.4 Extracting Your Key 9.5 Preparing a Message for Transmission 9.6 Processing a Received Message 9.7 Adding Keys to Your Public Key Ring 9.8 Certifying MacPGP Chapter 10 Macintosh PGP Reference 10.1 PGP Messages Window 10.2 Help Menu 10.3 File Menu 10.4 Key Menu 10.5 Options Menu Chapter 11 Windows PGP 11.1 WinPGP 11.2 PGP WinFront PART III Supplemental Information Chapter 12 The Building Blocks of PGP 12.1 Conventional Encryption: IDEA 12.2 Public Key Encryption: RSA 12.3 Secure Hash Function: MD5 Chapter 13 Choosing Your Passphrase 13.1 How to Guess a Passphrase 13.2 How to Choose an Unguessable Passphrase Chapter 14 Where to Get PGP Chapter 15 Public Key Servers 15.1 How to Use Public Key Servers 15.2 Where to Find Public Key Servers 15.3 Stable Large EMail Database (SLED) Chapter 16 PGP 3.0 Foreword by Philip Zimmermann This book is about Pretty Good Privacy, a program I created to encrypt e- mail using public key cryptography. PGP was electronically published as free software in 1991. Little did I realize what this project would lead to. PGP has become the worldwide de facto standard for e-mail encryption. I've admired Bill Stallings's writings in computer science for some years before PGP, and here he is writing a book about my program. How can I talk about how great his book is, without, by implication, talking about how great PGP is? It's hard to write a foreword for his book about PGP without sliding into some measure of self-indulgence. I've been so close to this project for so long that I sometimes lose sight of the scope of what PGP provides. I got the manuscript for Bill's book in the mail the other day -- the book you are holding. Sitting down with it, flipping through it, endless pages of diagrams, the formal treatment of it, services provided by PGP. It wasn't till I saw his book on PGP that I could step back and see PGP as others see it. The breadth of it. As a software engineer, I'm used to either documenting my own software, or having a random company tech writer document it. All software engineers get that. But having William Stallings do the manual for your software -- it's sort of like having your portrait done by a world-class artist. There are a very small number of software packages that have far- reaching political implications. Most software that fits in such an influential category has negative effects on our civil liberties. For example, government intelligence agencies use a software package called PROMIS, which is a powerful tool of governments to track people's activities, movements, spending, political affiliations, et cetera. Now that is a piece of software with far-reaching political implications. Mostly bad ones. Then there is the software that the Medical Information Bureau uses to classify people who file medical insurance claims, to put them on a medical "black list", so that they cannot purchase any medical insurance ever again. That software has far-reaching political implications -- enough to raise a large- scale backlash in our society to do something about it. In most cases, it seems that software that has powerful political effects is software designed to strengthen the strong and weaken the weak. But PGP also has far-reaching political implications. Mostly good ones. In the Information Age, cryptography affects the power relationship between government and its people. The Government knows this all too well, as evidenced by their recent policy initiatives for the Clipper chip, which would give the Government a back door into all our private communications -- an Orwellian "wiretap chip" built into all our telephones, fax machines and computer networks. PGP strikes a blow against such dark trends, and has become a crystal nucleus for the growth of the Crypto Revolution, a new political movement for privacy and civil liberties in the Information Age. This government has done all they can to stop the emergence of a worldwide encryption standard that they don't have a back door into. And that same government has placed me under criminal investigation for unleashing this free software on the world. If indicted and convicted, I would face 41 to 51 months in a federal prison. Despite the pressure the Government has brought to bear against PGP (or perhaps because of it), PGP has become the most widely used software in the world for e-mail encryption, used by a variety of activists, and anyone else needing protection from the powerful. It's also used by ordinary people to protect their personal and business communications from prying eyes. PGP may have a future as an official Internet standard, as the Internet Engineering Task Force develops an interest in it. No one who wants to work in the area of Internet e-mail privacy should neglect studying PGP. Because of the "fax machine effect", more people who want to encrypt their e-mail are getting PGP because everyone else who encrypts their e-mail is already using it. Naturally, I want people to read the Official PGP User's Guide, which comes with the electronic distribution package of PGP (also in book form from MIT Press), because I wrote it. Also, I'm more entertaining and personable in my book. And more political. But Bill Stallings' book is more comprehensive than mine, more thorough, covering more detail, with a lot more diagrams. He's really good at completely nailing it down in a book. In fact, I'll probably use his book myself as my preferred reference to PGP. Philip Zimmermann Boulder, Colorado PGP Fingerprint: 9E 94 45 13 39 83 5F 70 7B E7 D8 ED C4 BE 5A A6 */ Section 2. Rants. For good rants FTP to soda.berkeley.edu /pub/cypherpunks/rants Section 3. CYPHERNOMICON - Tim May's "official" Cypherpunks' FAQ. This is a giant (1.3MB uncompressed) faq by Tim May. To get it by anonymous ftp: ftp to ftp.netcom.com /pub/tcmay - This directory has it & its associated files. Chapter 9. Cypherpunks' mailing list. getting on etc.. >>>> help This is Brent Chapman's "Majordomo" mailing list manager, version 1.92. In the description below items contained in []'s are optional. When providing the item, do not include the []'s around it. It understands the following commands: subscribe <list> [<address>] Subscribe yourself (or <address> if specified) to the named <list>. unsubscribe <list> [<address>] Unsubscribe yourself (or <address> if specified) from the named <list>. get <list> <filename> Get a file related to <list>. index <list> Return an index of files you can "get" for <list>. which [<address>] Find out which lists you (or <address> if specified) are on. who <list> Find out who is on the named <list>. info <list> Retrieve the general introductory information for the named <list>. lists Show the lists served by this Majordomo server. help Retrieve this message. end Stop processing commands (useful if your mailer adds a signature). Commands should be sent in the body of an email message to "Majordomo(a)toad.com". Commands in the "Subject:" line NOT processed. If you have any questions or problems, please contact "Majordomo-Owner(a)toad.com". Chapter 10. IRC chat strong encryption? Section 1. prig (cryptical)'s contribution. Do we really have this capability now? According to following post we do! This info has not been verified yet. You may want to experiment for yourself. Section 1. prig(cryptical)'s offering. From: prig0011(a)gold.tc.umn.edu Subject: IRC Encryption There was a thread a while back about encrypted conversations on channel #freedom on irc. I came across the software I believe they are using. Its a package called Circ, and it is available from archives of comp.sources.misc volume 38 issue 10. It is interesting in that it uses RSA for key exchange, and triple DES for the encryption. The Circ package includes an earlier implementation "socks" which is a stand alone encrypted irc client. I think this is what they use on #freedom. This is an interesting tool for a couple of reasons. irc can be as anonymous as you want to make it. There are ways of hiding what site you're coming from, your real username, you can change your nick often as you want, and it's got a high enough usage that you can lose yourself in a crowd. It supports background file transfers. You can create a channel and lock it to uninvited people. It is supported pretty much net-wide, if you can telnet, you can irc. Interesting stuff, and I'll be playing more with it in the near future. BTW: my nick is cryptical on irc. :) /* Section 2. Ed Carp's offer. According to Ed Carp, the package has been around for a long time & he's had it on his system for monthes. Ed says: "If anyone wants it, they can email me and I'll send it to them, tarred, gripped, and uuencoded." Ed Carp is ecarp(a)netcom.com */ PUSH EM BACK! PUSH EM BACK! WWWAAAYYYY BBBAAACCCK! BBBEEEAAATTTT STATE!

1 0

WWWing cypherpunks
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

It occured to me that a WWW browser could be used as a sophisticated newsreader like interface to a compiled mailing list, stored on a site. The site would archive the mailing list and index/organize the mail under author, time, subject, etc. I have written a lot of scripts to do WWW tasks and otehr mail parsing utilities. I would be willing to donate the programming time to this project if others were willing to donate the computing resources. For the Cypherpunks list the main requirement would be plenty of disk space. I would like to point out that most of the cypherpunk goals relate to defining "what is a society in cyberspace". The cypherpunk answer is "one that allows interaction & communicatin while at the same time preserving privacy and freedom of speech". Note that the Usenet model does not really hold absolute privacy as a design prerequisite. In fact the use of such mechanisms like the "nntp-posting-host" and the closure of the network to "outsiders" actually is hostile to pure anonymity (I will leave to others the question of whether anonymity==privacy). My point is that most cypherpunk goals could be attained by building an infrastructure that embodies the ideas in such a way that Usenet embodies a certain set of ideas for interaction. But the further point is that the system must be self-rewarding in the way that running an NNTP server is rewarding to the site operator. (Note that the oft-noted "stifled" or "lethargic" progress of remailers is probably due to this basic fact that there is no personal positive incentive for an operator to run one, except perhaps "admiration by cypherpunk peers", a novelty that wears off quickly in the face of heated complaints). Anyway, if the cypherpunks were to build a system that allowed "community interaction" the way Usenet does, kept the freedom, but preserved the privacy, and improved the signal-to-noise ratio, it would spread like wildfire. There would be no lamenting the lame progress; it would be intrinsically self propagating like a cyberspatial virus. I am willing to contribute to this by donating programming labor to building a WWW mailing list indexer that could evolve into a full-fledged communications system, if others are willing to donate some resources. ~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^ \ / ~/ |\| | | |> | Vladimir Z. Nuri : : : : : `Imagination is more important \/ /_ | | \_/ |\ | vznuri(a)netcom.com : : : : : : than knowlege' (Einstein)

2 1

How to do foreign transactions.
by jamesd＠netcom.com 17 Dec '03

17 Dec '03

First and foremost: A chain is as strong as its weakest link. So you do not use a consultant who works in the country where you are making your money. Repeating this for anyone slow witted. If you are making money in the USA, and wish to perform transactions outside the USA that you would prefer to remain private YOU DO NOT TRANSACT THROUGH A USA CONSULTANT. DO NOT USE A USA BASED CONSULTANT! The American IRS, and other bodies hostile to privacy, regularly go after such consultants, accuse them of real or imaginary crimes, threaten them with jail and sometimes with a rubber hose, and force them to sing like canaries. Worse still, a great many of them continue right on in the financial consultancy business while continuing to sing like canaries. So first and foremost you do not use a consultant that is subject to the violence of those that you most fear. Use a friend or a relative who is in a foreign country. Blood is thicker than water, relatives are better. No suitable relatives? Subscribe to foreign financial newspapers, and read the ads, subscribe to some of the newsletters advertised or reviewed in those newspapers. You might wish to subscribe to AGI PO Box 4010 6304 Zug Switzerland. This advertises stockbrokers, banks, and mutual funds all over the world that accept international transactions. That is a suggestion, not a recommendation. Do your own homework, and check your family tree for relatives dispersed around the world. OK, what comes second. Well second, third, fourth and fifth, same as above, do not use a consultant who is subject to the violence of those you most fear. Somewhere way down the list ... About thirty seventh down the list: All financial institutions that are beyond the violence of those you fear the most, are good. All of them! All of them! Even in countries quite hostile to privacy, they do not turn over financial information en masse to a foreign power, even when that foreign power is the USA. Say you fear the USA the most, and you have a bank account in another country. Say you have a bank account in Australia, a country with high taxes, absolutely no banking privacy, a country that routinely and regularly grovels to the USA. Even so, the ones you fear still have to find out that the account exists, information that they discover in the USA and *then* they have to ask their opposite number in Australia, "Hey, I did a favor for you, can you do a favor for me, pretty please with sugar on top?" If the enemy already have that kind of information on your financial doings, and they are keen enough on getting you that they are willing to do things that are special and out of the ordinary, then your goose is cooked anyway, regardless of whether your account is Australia or Liechtenstein. So who gives a tinkers dam? What points one to thirty seven boil down to is quite simple. The key question about any financial institution is: Can the revenuers kick down the door and pistol whip the operator if he fails to make everything in his computer totally and completely available to the revenuers? It really is that simple. If you are afraid of USA revenuers, then the difference between a USA bank, and a USA financial privacy consultant is so slight that it is not even worth thinking about. The difference between a Swiss bank and an Australian bank is small. The big difference is the difference between a USA entity and a foreign entity. Ignore all the mysterious arcane legalistic complexities uttered by the self proclaimed financial experts. It really is not very complicated at all. Simply apply the pistol whip question. Nothing else counts for very much. If a financial institution fails the pistol whip test, then its computers have a line to the IRS echoing everything that happens. If they do not have such a line now, they will very soon. If it passes the pistol whip test, then there is no line to the IRS. The IRS might be able to get information if they ask nicely about a particular person, but they will have to ask nicely and they cannot simply say: "Dump everything you have to our computers and make sure it is in a form that our computers like, and if something makes our computers hiccup, you're gonna sweat." I repeat: The key question is "Can they kick down the door and pistol whip the guy who owns the computers?" All other questions, such as what does the law say, and what legal system the institution operates under, are comparatively insignificant. Now obviously some banks are better than others. For most people this is not an important difference, but there is a difference. Now if you are a big time drug dealer living in exile, yeah, you had better worry about the fine detail of a nations banking secrecy laws. In that case the difference between Switzerland and Liechtenstein might be important to you. But fussing over the details of a countries banking laws is like worrying about sources of randomness in session keys. It is not likely to make the slightest difference in practice. Of all the banks that have some degree of secrecy, Swiss banks are the best, not that they have the strongest secrecy, but because they are real banks, they are not just post office boxes, and the same laws apply to everyone. Your money is safe in Switzerland not because they are trying to lure foreign hot money -- in fact they are trying to exclude foreign hot money. You almost have to sneak your money into Switzerland in the same way you sneak it out of the US. Your money is safe in Switzerland because Swiss property is safe in Switzerland. In Switzerland you are protected by Swiss liberty, not by foreign privilege. For your enemies to get information about your Swiss bank account, they are going to have to know what you have been up to. And, knowing what you are up to, they are not going to merely have to ask a favor, as they would in most countries. They are going to have to go before a foreign court. They are going to have to jump through legalistic hoops that they did not write in a court that they cannot control. They will have to deal with powerful people on those peoples home ground. They are profoundly reluctant to do this. It makes them feel weak and helpless. Unless they know you are up to something *and* they have serious hots for you, they are not going to do it. So unless you are a foreign dictator that the US might wish to overthrow, or unless you got the IRS chief's daughter pregnant and skipped town, you really do not need to give a dam. And if you attract their attention, and seriously upset them, then nothing is safe. They will obtain the key to that Liechtenstein safety deposit box by bribery, illegal methods, and by threatening people with massive baseless lawsuits. (This happened to one famous tax resister. The King of Liechtenstein will tell them to go eat shit, but a lawyer in Liechtenstein will roll over like a puppy dog.) Or they will lock you up in solitary, with your only source of conversation being thirty hour chat sessions with IRS agents with bright lights shining in your eyes, until you are willing to confess that you killed Kennedy and you were Jack the Ripper and you damn well give them the key. Which brings to point thirty eight, the least and slightest of the matters you should keep in mind. Obviously some institutions and some countries are more vulnerable to persuasion and pressure by foreigners than others. I am told the King of Liechtenstein is strongly resistant. Doubtless this is true. But if there are two financial institutions, and one is a major Swiss bank, and one is actually a lawyer operating a mail drop, guess which one rolls over first, even if the lawyer is located in Liechtenstein. One needs to consider both the reputation of the country and the reputation of the institution. (You might also consider that, on the other hand, the hole-in-the-wall lawyer in Liechtenstein can give you facilities that achieve much the same thing as a fiduciary account at a price you can afford, whereas a big Swiss bank would not give you a fiduciary account unless you had serious money. Yet again you might consider that something like a fiduciary account is ridiculous overkill for most people) But I repeat, compared to the vast difference between someone they can pistol whip, and someone they cannot pistol whip, the difference between two people, neither of whom can be pistol whipped, is very slight. It really does not matter that much. Just get your money out of gunshot. Legal technicalities would only matter if the government gave a shit about legal technicalities. Once your money is out of gunshot, it really does not make a very big difference where you put it. Go for decent rates of return, and ignore too-clever-by-half secrecy schemes. -- --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we James A. Donald are. True law derives from this right, not from jamesd(a)acm.org the arbitrary power of the omnipotent state.

1 0

Re: Islands in the Net
by Andrew Lowenstern 17 Dec '03

17 Dec '03

tcmay(a)netcom.com (Timothy C. May) writes: > What's the common theme? Agents. Chunks of code which also have > local processing power (brains, knowledge). > > Someone sent me private e-mail on this "Islands in the Net" topic, > and talked about "payloads of data carrying their own instructions," > in reference to the Telescript model of agents. (I wish he'd post > his comments here!) This approach, also typified in some > object-oriented approaches, seems to be the direction to go. <note: this message was originally the one Tim references in the above, but I have edited and added much to it after letting it percolate in my brain for a day or so...> Naked data is dumb and computers aren't much smarter. Computers need instructions from humans to act on that data, and when you separate the data from the instructions that act on it you have problems. If a hunk of data arrives on your machine and you don't have any code to make sense of it, you are SOL. Likewise if the code that interprets that data isn't "correct" for that data you run into problems. By making the instructions that act on data an integral part of that data, you can avoid problems. This is just the object-oriented programming concept of encapsulation of course. Of course, encapsulation (or OOP for that matter) is no silver bullet for solving this problem at least in the way we are approaching it. It takes a lot of code and a lot of agreement among people. I think it's the human error (including shortcuts) and the lack of communication among humans that contributes the most to software fragility and lack of robustness. What's more is the distinction between data and code is very well entrenched in modern computing. The executable code is nearly always a separate entity from the data it acts on. Not only does the hardware and OS make the distinction between code and data, most programmers do as well. Even though C++ seems like the de facto standard for new software these days, few applications written with it practice strict encapsulation. There is a blurb in last month's Wired (the one with "Rocket Science" on the cover) where they touch on this subject a bit (I don't have it handy), but the author there draws the same conclusion as I: it will take a very radical and fundamental change in computing before this becomes reality. No amount of committee meeting (CORBA) or application level software sugar (OpenDoc, OLE, whatever) is going to change this, or at least make it work. At the core every machine makes the distinction between data and code. Operating systems make distinctions between applications and data files. Until the hardware and the OS start believing that data and code are one as well as the programming languages and APIs, we won't get anywhere. Heck, computers have been around for 40+ years and the primary data interchange format between systems is still just a dumb stream of bit encoded characters. Maybe.... Agents like TeleScript really intrigue me... and I think the are closer to what we need to do this than any of the myriad suggestions coming out of the OOP community (like CORBA, OLE, OpenDoc, etc...). Intelligent agents carrying their payload of data through the network. However, the agents have to be able to run their code on any machine and without having the capability to do 'damage' (most institutions _prefer_ to be islands on the net because of fear of 'hackers'). In addition, the agents, as a collection of code and data, have to mutatable is some way to be able to process the data in new ways. What if remailers were implemented using 'agents'? Instead of me sending a dumb message to a smart remailer, what if I could send smart remailer, with an encrypted message embedded in it, to a friendly machine offering agents access to SMTP (i.e. a machine that allowed any authorized agent to arrive and initiate an outgoing tcp stream to the SMTP port of any other machine). Now I can make my remailer system as convoluted as I want, simply by programming this agent to cruise around machines that answer when it knocks. Once it has moved between enough hosts, it moves to a host that offers outgoing SMTP connections and delivers it's payload. No longer am I limited by the time and effort of the remailer operators to implement fancy new features. Any machine that gives access to my agent becomes another hop in my remailer chain (or whatever purpose I want). All my remailer agent needs to operate is one host, the final destination, that will let it make an outgoing SMTP connection, which could be provided by the hosts currently running remailers. What if this e-mail message you are reading was really an agent instead of just data? A basic e-mail message protocol would be needed for your mail-reading software to interact with it. I'm using protocol here in the sense that NeXT uses it in their version of the Objective-C language. Protocols there are a formal interface definition for an object that isn't tied to a class. If my mail message object (or agent) conformed to the mail protocol, it would have to implement all of the methods defined in the protocol (maybe methods like "giveMeTheMessageContents", "deliverThisReply:", "forwardToThisAddress:", etc...). Wow, now I have a smart e-mail message. I could recode the "deliverThisReply" method to go through anonymous remailer systems or basically anything it wanted. Now instead of praying that the recipient is savvy enough to handle using an encrypted remailer reply block, the recipient just replies as normal and their mail-reader hands the reply to my agent which goes off and does it's magic. I know very little of TeleScript (i.e. I haven't gotten my grubby little hands on it), but I do know that it implements some crypto features for authentication and the like. This type of system won't work unless people are absolutely sure it's secure. By secure I mean people should be confident that when they open their hosts to agents there is no way for agents to access services not explicitly granted to them... I think this is the future of distributed network computing... servers on the network provide basic services (by basic I mean CPU time, network connections, disk storage, etc...) to be utilized by smart agents, as well as smart agents carrying payloads and interacting with 'normal' software (like in my mail message example). There is pretty much no chance that a fundamental paradigm shift in the relationship between code and data will occur at all levels, at least not all at once, there's just too much stuff out there already. But it seems to me that a well-engineered agent system could be a decent compromise, or a move towards the end of code/data duality, that has a good chance of gaining widespread acceptance. enough, andrew

2 1

Re: Changes to remailer@jpunix.com
by Random Factor 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Date: Wed, 16 Nov 1994 14:16:46 -0600 > From: "John A. Perry" <perry(a)jpunix.com> > Subject: Changes to remailer(a)jpunix.com > Well folks... > It happened again. Last night jpunix was used to post proprietary > code to the net. I had to spend a couple of hours on the phone with the > authors of the code, generating cancel messages, etc.. It seems that > jpunix is a magnet for those that wish to abuse the remailers. > Since jpunix seems to attract problem users, I have installed some > safeguards in the remailer that will hopefully add a level of difficulty > to those that wish to abuse while remaining transparent to proper usage. here are some other ideas to consider in addition to or instead of the 20k limit: * require encryption for incoming messages. * require that the sender, the receiver, or both be a known remailer address. at least one other remailer has to be involved. * impose a 20k limit on message unless they are received from a known remailer and sent to a known remailer. randy -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLstzsM1Uod4Abd1NAQGJUwQAnUB9CGdheNImzapwbtlfpWmnygrdpSva qioE5FM3U19knz+nwsEUYKE/xKAyC0G+jou0dmNy+W6NQ9QwCMslQ0YdR3hRxyMT DBiodSFu23H/6R+7PYUNscM9T2Lr/imkHLZZtxbcV7/IBzqlX9VdVFLd5/rWs4Fh Nk+BlhTwwjI= =srSt -----END PGP SIGNATURE-----

4 4